Agentic Sandbox v2026.7.15

Released: 2026-07-29 Tag: `v2026.7.15` Previous published: `v2026.7.14`

What changed

Management-created Docker networks are now created with Docker's internal network mode. Managed containers on those networks no longer receive a Docker-routed path to public IP addresses by default. Sanitized negative checks exercise cross-network and public-IP TCP denial, and the release evidence maps the current implementation to the transport acceptance criteria.

Docker image validation now uses available shared Linux runner capacity. This avoids the exhausted build01 container snapshot store while leaving Rust, conformance, host-runtime, and supply-chain validation on the dedicated build runner.

Upgrade

Upgrade the management service, then recreate management-owned Docker networks and their containers. Existing Docker networks are not changed in place.

Verify release artifacts against the published checksum manifests and follow the standard release verification guide.

Known security limits

This is a default-egress hardening release, not a claim of Tier 1 container isolation.

• Operator-supplied Docker networks are outside the managed-network guarantee

and remain Tier 0.

• Containers still use management-issued mTLS material rather than a

Unix-domain-socket-only transport, so transport acceptance criterion AC-1 remains blocked.

• A process running as the same host UID as the management service can read

live credential material. Issue #617 tracks the required broker/sidecar and distinct-workload-UID architecture; it is not closed by this release.

• The explicitly unsigned Apple developer package remains evaluation-only. No

Developer ID, notarization, stapling, or Gatekeeper-trust claim is made.

Rollback

The previous stable release is `v2026.7.14`. Rolling back restores the previous managed-network behavior; review egress policy before doing so.

Full notes: `CHANGELOG.md` `[2026.7.15]`.